What we keep, and what we do not.
Here is what tinyous stores and what it doesn't. If we change what we collect or how long we keep it, we'll update this page first.
Who
CME United runs tinyous.com and the tnyx.us short-link domain. Questions go through Contact. There is not a separate privacy office.
Your account
We store your email, name, a password hash, optional authenticator secret, backup codes, and an API key if you use one. We send verify, reset, sign-in, and paid-plan receipts. A card receipt may arrive separately. Payments are processed by Stripe. We do not store your card number. A note from Contact is kept only so we can reply.
Your links
We store the destination URL, slug, optional title, tags, and UTMs, QR colors and logo, and whether the link is active. Those stay on your account. The long URL is yours.
Clicks
Each redirect stores the time, the HTTP referrer, the user agent, and a SHA-256 hash of the visitor IP. We do not store the raw IP. We do not look up location. We do not sell click rows or use them for advertising. Campaign UTMs are your tags for your analytics, not ours.
Custom hostnames
If you add one, we store the hostname and the TXT token we asked you to publish, plus when it verified.
Cookies
Signed-in pages use a session cookie (HttpOnly, SameSite Lax; Secure on https). That is how we know it is you. There is no advertising cookie. If Google Tag Manager or GA4 is configured, those scripts load only on tinyous pages (home, pricing, account, and the rest of the UI). Short-link redirects do not run them. Google may set its own cookie so we can see our marketing. We do not use that for ads, and we do not send your click rows into our GA property.
How long
We have not set an automatic delete-after date. While you have an account, the rows stay so the short URL and the export still work. We keep an off-box backup and we have tested a restore. We will write a retention period here before we start deleting click history. From Links you can export every link and every click row we will give you (time, referrer, user agent — not the IP hash).
Who else sees it
The people who already operate this server. The mail provider sees the address we send to. Google sees tinyous page views if GTM/GA4 is on. Creating an account, and a note from Contact, also send a check to Google. We do not sell accounts or click data. Like any service, we may have to respond to a valid legal request or a serious abuse report.